<!DOCTYPE html><html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<p><font face="monospace">Dear all,</font></p>
<p><font face="monospace">we do maintain two CES clusters (CESA and
CESB), and used to migrate virtual IPs from one to the other
when doing maintenance. This worked great, but: now we have
introduced kerberized NFSv4. In order to have this same
functionality, we thought of moving the SPNs corresponding to
the vIPs from one AD object to another, so for example</font></p>
<p><font face="monospace"><br>
</font></p>
<p><font face="monospace"># Before the move:</font></p>
<p><font face="monospace">CESA has nfs/ces-1.domain.com </font><font face="monospace">nfs/</font><font face="monospace">ces-2.domain.com</font></p>
<p><font face="monospace">CESB has </font><font face="monospace">nfs/</font><font face="monospace">ces-3.domain.com</font></p>
<p><font face="monospace"># After the move</font></p>
<p><font face="monospace">CESA has nfs/ces-1.domain.com</font></p>
<p><font face="monospace">CESB has </font><font face="monospace">nfs/</font><font face="monospace">ces-3.domain.com </font><font face="monospace">
</font><font face="monospace">nfs/</font><font face="monospace">ces-2.domain.com</font></p>
<p><font face="monospace"><br>
</font></p>
<p><font face="monospace">This kinda works out, but we do have
troubles with the client credential caches, in the sense that
the NFS mount works again after we do:</font></p>
<p><font face="monospace">kdestroy -c
/var/lib/gssproxy/clients/krb5cc_0 && KRB5CCNAME=KCM:
kdestroy -A<br>
</font></p>
<p><font face="monospace"><br>
</font></p>
<p><font face="monospace">Does anybody have a similar setup /
usecase, or how do you manage e.g. upgrades without downtime or
multiple CES clusters?</font></p>
<p><font face="monospace">Thanks for any insight!</font></p>
<p><font face="monospace"><br>
</font></p>
<p><font face="monospace">cheers</font></p>
<p><font face="monospace">leo<br>
</font></p>
<p><font face="monospace"><br>
</font></p>
<p></p>
<pre class="moz-signature" cols="72">--
Paul Scherrer Institut
Dr. Leonardo Sala
Group Leader Data Analysis and Research Infrastructure
Group Leader Data Curation a.i.
Deputy Department Head Science IT Infrastructure and Services department
Science IT Infrastructure and Services department (AWI)
OBBA/230
Forschungstrasse 111
5232 Villigen PSI
Switzerland
Phone: +41 56 310 3369
<a class="moz-txt-link-abbreviated" href="mailto:leonardo.sala@psi.ch">leonardo.sala@psi.ch</a>
<a class="moz-txt-link-abbreviated" href="http://www.psi.ch">www.psi.ch</a></pre>
</body>
</html>